dependency-check / dependency-check/DependencyCheck

CENTRAL - NODEAUDIT - POM Cached results never expire

Open
#8,757 7 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Java
Stars
7.7k
Forks
1.4k
Avg merge
9d 22h
Merged PRs (30d)
13

Description

**Precondition**
- [X] I checked the issues list for existing open or closed reports of the same problem.

**Describe the bug**
When caches are activated for CENTRAL - NODEAUDIT and POM, results are cached but with the internal flag isEternal set to true.

**Version of dependency-check used**
The problem occurs using version 13.0.0 of the maven plugin, but it affects the core module

**Log file**

**To Reproduce**
Steps to reproduce the behavior:
1. Run a first dependency check, on a module containing node module and specially file package-lock.json, with default configuration. Cache should be created, in folder org/owasp/dependency-check-data/11.0/cache under maven respository
2. Wait 24h and expect there is new vulnerability on the module
3. Run again the check
4. The new vulnerability is not thrown

**Expected behavior**
Cache results should expire after the configuration time

**Additional context**
Difficult to check with log file or module, as it depends on known vulnerabilities.

The error is in the file dependencycheck-cache.properties

This will apply to "default" configuration
```
jcs.default.elementattributes.IsEternal=false
```

But the configuration is not set on region CENTRAL - POM - NODEAUDIT

But in the lib commons-jc3-core lib, default values are not applied as default value on region configuration. It is used when the configuration for the region does not provide the key jcs.region..elementattributes, usually with value org.apache.commons.jcs3.engine.ElementAttributes.

A temporary fix for the moment is to add a system variable in Maven command, like
```
-Djcs.region.CENTRAL.elementattributes.IsEternal=false
-Djcs.region.POM.elementattributes.IsEternal=false
-Djcs.region.NODEAUDIT.elementattributes.IsEternal=false

```
But if caches already contain result, the eternal flag is already set to true in cached result. Arguments from command line do not solve the issue.

Second solution, update the file dependencycheck-cache.properties with:
```
jcs.region.CENTRAL.elementattributes.IsEternal=false
jcs.region.POM.elementattributes.IsEternal=false
jcs.region.NODEAUDIT.elementattributes.IsEternal=false
```
But it will need to delete the existing cache, for the same reason as previous fix.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.